We&#39;ve used [OpenSSL][1] with good success. Portable, standards compliant and easy to use.


  [1]: http://www.openssl.org/

I&#39;ve used CryptoPP in the past (http://www.cryptopp.com/) and although its API style and programming paradigms take a little getting used to, I liked it in the end. It provides a wide range of symmetric and asymmetric algorithms with much flexibility. Documentation is so-so, the API docs are there but there&#39;s little &#39;high-level&#39; overview and simple sample code. I ended up puzzling together pieces of code from around the net. It was easy to integrate into my project (linked statically). I&#39;m using MSVC - 2003 when I started using it, now switched to 2008. It&#39;s portable across several platforms (check out the website). I&#39;ve always used the default RNG, don&#39;t know which one that is.

I&#39;m gonna have to go with [LibTomCrypt](https://github.com/libtom/libtomcrypt).  It&#39;s often overlooked for OpenSSL, but TomCrypt is just so lightweight and simple.  As for quality, TomCrypt is widely accepted as top-quality encryption.  Also, it&#39;s license is public domain which avoids the attribution hassle for your documentation that BSD licenses give you when writing commercial software.

My favorite is GNU&#39;s library:

[libgcrypt](http://www.gnu.org/software/libgcrypt/)

Its performance is good, and it&#39;s used EVERYWHERE so it&#39;s very well tested.

[Crypto++][1] seems to have a very good reputation

Wikipedia - https://en.wikipedia.org/wiki/Crypto%2B%2B

GitHub - https://github.com/weidai11/cryptopp


  [1]: https://cryptopp.com

The C++ version isn&#39;t out yet but goolge KeyCzar http://code.google.com/p/keyczar/ might be worth looking at.  Whatever you feel about their business they do have a lot of smart programmers working for them.

[GPGme][1]. Simple to use and compatible with the [OpenPGP format][2]


  [1]: http://www.gnupg.org/related_software/gpgme/index.en.html
  [2]: http://www.ietf.org/rfc/rfc4880.txt

I&#39;m having some trouble with plain old JavaScript (no frameworks) in referencing my object in a callback function.

    function foo(id) {
        this.dom = document.getElementById(id);
        this.bar = 5;
        var self = this;
        this.dom.addEventListener(&quot;click&quot;, self.onclick, false);
    }
    
    foo.prototype = {
        onclick : function() {
            this.bar = 7;
        }
    };

Now when I create a new object (after the DOM has loaded, with a span#test)

    var x = new foo(&#39;test&#39;);

The &#39;this&#39; inside the onclick function points to the span#test and not the foo object.

How do I get a reference to my foo object inside the onclick function?

JavaScript Callback Scope

I know that the #warning directive is not standard **C**/C++, but several compilers support it, including gcc/g++.  But for those that don&#39;t support it, will they silently ignore it or will it result in a compile failure?  In other words, can I safely use it in my project without breaking the build for compilers that don&#39;t support it?

Portability of #warning preprocessor directive

What is the best encryption library in C/C++ In terms of: 

  - entropy  
  - quality 
  - ease of use
  - readability
  - portability 
  - performance

What&#39;s your favorite and why do you like it? 

What is the best encryption library in C/C++?

<p>What is the best encryption library in C/C++ In terms of:</p>
<ul>
<li>entropy</li>
<li>quality</li>
<li>ease of use</li>
<li>readability</li>
<li>portability</li>
<li>performance</li>
</ul>
<p>What's your favorite and why do you like it?</p>


Is there a freely available Base64 decoding code snippet in C++?




Base64 decode snippet in C++

I&#39;m working on a commercial (not open source) C++ project that runs on a  linux-based system.  I need to do some regex within the C++ code.  (I know:  I now have 2 problems.)

QUESTION:  What libraries do people who regularly do regex from C/C++ recommend I look into?  A quick search has brought the following to my attention:

1) Boost.Regex (I need to go read the Boost Software License, but this question is not about software licenses)

2) C (not C++) POSIX regex (#include &amp;lt;regex.h&amp;gt;, regcomp, regexec, etc.)

3) http://freshmeat.net/projects/cpp_regex/  (I know nothing about this one; seems to be GPL, therefore not usable on this project)


C++: what regex library should I use?

Apparently ;-) the standard containers provide some form of guarantees.

What type of guarantees and what exactly are the differences between the different types of container?

Working from [the SGI page][1] (about [STL][2]) I have come up with this:

    Container Types:
    ================
    Container:
        Forward Container
            Reverse Container
                Random Access Container
        Sequence
            Front Insert Sequence
            Back  Insert Sequence
        Associative Container
            Simple   Associative Container
            Pair     Associative Container
            Sorted   Associative Container
            Multiple Associative Container

    Container Types mapped to Standard Containers
    =============================================

    std::vector:    Sequence    Back        Sequence                    Forward/Reverse/Random Container
    std::deque:     Sequence    Front/Back  Sequence                    Forward/Reverse/Random Container
    std::list:      Sequence    Front/Back  Sequence                    Forward/Reverse Container
    std::set:       Sorted/Simple/Unique    Associative Container       Forward Container
    std::map:       Sorted/Pair/Unique      Associative Container       Forward Container
    std::multiset:  Sorted/Simple/Multiple  Associative Container       Forward Container
    std::multimap:  Sorted/Pair/Multiple    Associative Container       Forward Container


    Container Guarantees:
    =====================

                                                                                      Simp
                                                                                      or
                              For   Rev  Rand        Front  Back  Assoc        Sort   Mult
                        Cont: Cont: Cont Cont: Sequ: Sequ:  Sequ: Cont:        Cont:  Cont:
    Copy    Const:      O(n)
    Fill    Const:                             O(n)
    begin()             O(1)
    end()               O(1)
    rbegin()                        O(1)
    rend()                          O(1)
    front()                                    O(1)
    push_front()                                     O(1)
    pop_front()                                      O(1)
    push_back()                                             O(1)
    pop_back()                                              O(1)
    Insert()                                                                          O(ln(n))
    Insert: fill                               O(n)
    Insert: range                              O(n)                                   O(kln(n)+n)
    size()              O(1)
    swap()              O(1)
    erase key                                                     O(ln(n))
    erase element                                                 O(1)
    erase range                                                   O(ln(n)+S)
    count()                                                       O(log(n)+k)
    find()                                                        O(ln(n))
    equal range                                                   O(ln(n))
    Lower Bound/Upper Bound                                                    O(ln(n))
    Equality                  O(n)
    InEquality                O(n)
    Element Access                       O(1)

  [1]: http://www.sgi.com/tech/stl/
  [2]: http://en.wikipedia.org/wiki/Standard_Template_Library


What are the complexity guarantees of the standard containers?

When working on a big C/C++ project, do you have some specific rules regarding the *#include* within source or header files?

For instance, we can imagine to follow one of these two excessive rules:

 1. *#include* are forbidden in *.h* files; it is up to each *.c* file to include all the headers it needs
 2. Each *.h* file should include all its dependancies, i.e. it should be able to compile alone without any error.

I suppose there is trade-off in between for any project, but what is yours? Do you have more specific rules? Or any link that argues for any of the solutions? 

Your preferred C/C++ header policy for big projects?

I would like to be able to write a Java class in one package which can access non-public methods of a class in another package without having to make it a subclass of the other class. Is this possible?

Is there a way to simulate the C++ &#39;friend&#39; concept in Java?

I&#39;ve worked on many projects where I&#39;ve been given code by others to update. More often than not I compile it and get about 1,000+ compiler warnings. When I see compiler warnings they make me feel dirty, so my first task is to clean up the code and remove them all. Typically I find about a dozen problems like uninitialized variables such.

I don&#39;t understand why people leave them in and don&#39;t have perfectly clean compiles with no warnings. Am I missing something? Is there any valid reason to just leave them? Any horror stories to share?

C / C++ compiler warnings: do you clean up all your code to remove them or leave them in?

During recent discussions at work, someone referred to a trampoline function.

I have read the description at [Wikipedia][1].  It is enough to give a general idea of the functionality, but I would like something a bit more concrete.

Do you have a simple snippet of code that would illustrate a trampoline?


  [1]: http://en.wikipedia.org/wiki/Trampoline_(computers)

What is a trampoline function?

`itoa()` is a really handy function to convert a number to a string. Linux does not seem to have `itoa()`, is there an equivalent function or do I have to use `sprintf(str, &quot;%d&quot;, num)`?

Where is the itoa function in Linux?

    inline int factorial(int n)
    {
        if(!n) return 1;
        else return n*factorial(n-1);
    }

As I was reading [this][1], found that the above code would lead to &quot;infinite compilation&quot; if not handled by compiler correctly.

How does the compiler decide whether to inline a function or not ?


  [1]: http://www.amazon.com/Design-Evolution-C-Bjarne-Stroustrup/dp/0201543303/ref=pd_bbs_sr_1?ie=UTF8&amp;s=books&amp;qid=1223616411&amp;sr=8-1

Can a recursive function be inline?

Any &lt;a href=&quot;http://en.wikipedia.org/wiki/Salt_%28cryptography%29&quot;&gt;salt&lt;/a&gt; at all will obviously help when salting and hashing a user&#39;s password.  Are there any best practices for how long the salt should be?  I&#39;ll be storing the salt in my user table, so I would like the best tradeoff between storage size and security.  Is a random 10 character salt enough? Or do I need something longer?

What is the optimal length for user password salt?

When sending data over HTTPS, I know the content is encrypted, however I hear mixed answers about whether the headers are encrypted, or how much of the header is encrypted.

How much of HTTPS headers *are* encrypted?

Including GET/POST request URLs, Cookies, etc.

Are HTTPS headers encrypted?

How can I encrypt and decrypt a string in C#?

Encrypt and decrypt a string in C#?

Currently I&#39;m writing it in clear text *oops!*, it&#39;s an in house program so it&#39;s not that bad but I&#39;d like to do it right. How should I go about encrypting this when writing to the registry and how do I decrypt it?

    OurKey.SetValue(&quot;Password&quot;, textBoxPassword.Text);


What is the easiest way to encrypt a password when I save it to the registry?

At work we have two competing theories for salts.  The products I work on use something like a user name or phone number to salt the hash.  Essentially something that is different for each user but is readily available to us.  The other product randomly generates a salt for each user and changes each time the user changes the password.  The salt is then encrypted in the database.

My question is if the second approach is really necessary?  I can understand from a purely theoretical perspective that it is more secure than the first approach, but what about from a practicality point of view.  Right now to authenticate a user, the salt must be unencrypted and applied to the login information.  

After thinking about it, I just don&#39;t see a real security gain from this approach.  Changing the salt from account to account, still makes it extremely difficult for someone to attempt to brute force the hashing algorithm even if the attacker was aware of how to quickly determine what it was for each account.  This is going on the assumption that the  passwords are sufficiently strong.  (Obviously finding the correct hash for a set of passwords where they are all two digits is significantly easier than finding the correct hash of passwords which are 8 digits).  Am I incorrect in my logic, or is there something that I am missing?


**EDIT:** Okay so here&#39;s the reason why I think it&#39;s really moot to encrypt the salt.  (lemme know if I&#39;m on the right track).  

For the following explanation, we&#39;ll assume that the passwords are always 8 characters and the salt is 5 and all passwords are comprised of lowercase letters (it just makes the math easier).

Having a different salt for each entry means that I can&#39;t use the same rainbow table (actually technically I could if I had one of sufficient size, but let&#39;s ignore that for the moment).  This is the real key to the salt from what I understand, because to crack every account I have to reinvent the wheel so to speak for each one.  Now if I know how to apply the correct salt to a password to generate the hash, I&#39;d do it because a salt really just extends the length/complexity of the hashed phrase.  So I would be cutting the number of possible combinations I would need to generate to &quot;know&quot; I have the password + salt from 13^26 to 8^26 because I know what the salt is.  Now that makes it easier, but still really hard.  

So onto encrypting the salt.  If I know the salt is encrypted, I wouldn&#39;t try and decrypt (assuming I know it has a sufficient level of encryption) it first.  I would ignore it.  Instead of trying to figure out how to decrypt it, going back to the previous example I would just generate a larger rainbow table containing all keys for the 13^26.  Not knowing the salt would definitely slow me down, but I don&#39;t think it would add the monumental task of trying to crack the salt encryption first.  That&#39;s why I don&#39;t think it&#39;s worth it.  Thoughts?

Here is a link describing how long passwords will hold up under a brute force attack:
[http://www.lockdown.co.uk/?pg=combi][1]


  [1]: http://www.lockdown.co.uk/?pg=combi

Content Type	Original Author	Original Content on Stackoverflow
Question	paxos1977	View Question on Stackoverflow
Solution 1 - C++	Rob Walker	View Answer on Stackoverflow
Solution 2 - C++	Roel	View Answer on Stackoverflow
Solution 3 - C++	bmdhacks	View Answer on Stackoverflow
Solution 4 - C++	dicroce	View Answer on Stackoverflow
Solution 5 - C++	warren	View Answer on Stackoverflow
Solution 6 - C++	Martin Beckett	View Answer on Stackoverflow
Solution 7 - C++	bortzmeyer	View Answer on Stackoverflow

What is the best encryption library in C/C++?

C++ Problem Overview

C++ Solutions

Solution 1 - C++

Solution 2 - C++

Solution 3 - C++

Solution 4 - C++

Solution 5 - C++

Solution 6 - C++

Solution 7 - C++

Portability of #warning preprocessor directive

JavaScript Callback Scope

Attributions